What is command and control (C2) as an ATT&CK tactic?

Command and control is the tactic attackers use to talk to the systems they have compromised: to send commands, receive results and deliver more tools. Techniques include regular check-ins over web protocols, encrypted channels, legitimate cloud services or messaging platforms used as relays, tunnelling through DNS or other protocols, non-standard ports, and proxies that hide the real server. Because the channel has to exist for the attacker to act, it is one of the most reliable things to detect, even when the content is encrypted: timing, destination and rhythm give it away. Blocking known bad destinations helps but does not catch new ones. NetSenX flags beaconing on every plan and DNS tunnelling, and from the Starter plan compares TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. handshakes with fingerprints of known malware where the agent captures packets, on Linux or as a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it./TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. sensor.

← All 69 questions on Attack techniques explainedAll topics